Bug type
Regression (worked before, now fails)
Summary
On macOS behind an HTTP(S) proxy, google-gemini-cli OAuth consistently fails with:
TypeError: fetch failed
This happens even though:
• The proxy works for all relevant Google endpoints (verified via curl)
• The oauth.ts in @google/gemini-cli has already been patched with DEFAULT_FETCH_TIMEOUT_MS = 60000 and pinDns: false
Using the Google API key provider (google/gemini-3.1-pro-preview) works fine.
Only the google-gemini-cli OAuth flow is broken.
Environment
• Network: macOS system HTTP(S) proxy enabled
• HTTP/HTTPS proxy: http://127.0.0.1:7897
• Also tried with explicit HTTP_PROXY / HTTPS_PROXY in the shell
Steps to reproduce
- On macOS, configure a working HTTP(S) proxy (Clash Verge):
- Verify the proxy can reach Google OAuth / Gemini endpoints, e.g.:
HTTPS_PROXY=http://127.0.0.1:7897 HTTP_PROXY=http://127.0.0.1:7897 curl -I https://accounts.google.com
HTTPS_PROXY=http://127.0.0.1:7897 HTTP_PROXY=http://127.0.0.1:7897 curl -I https://oauth2.googleapis.com
HTTPS_PROXY=http://127.0.0.1:7897 HTTP_PROXY=http://127.0.0.1:7897 curl -I https://generativelanguage.googleapis.com
All should return valid HTTP/2 responses (200/302/404).
3. Install OpenClaw 2026.3.12 globally via npm and run the gateway once to initialize:
npm i -g openclaw
openclaw gateway
4. In another terminal, attempt to configure google-gemini-cli auth:
openclaw models auth login --provider google-gemini-cli --set-default
5. In the browser that opens, complete the Google OAuth flow for Gemini CLI.
• The callback to http://localhost:8085/oauth2callback appears successful.
6. Observe that the CLI prints:
◇ Gemini CLI OAuth failed
TypeError: fetch failed
and no auth profile is created for google-gemini-cli in auth-profiles.json.
### Expected behavior
openclaw models auth login --provider google-gemini-cli should complete the OAuth flow behind an HTTP proxy on macOS, given:
• All Google endpoints are reachable through the proxy
• oauth.ts is using pinDns: false and a 60s timeout
### Actual behavior
OAuth flow works in the browser and callback is hit, but the CLI fails with TypeError: fetch failed during token exchange.
• No further error context is surfaced (likely due to internal catch {} swallowing the underlying error, similar in spirit to issue #42541).
### OpenClaw version
2026.3.12 (6472949)
### Operating system
macOS (Apple Silicon)
### Install method
npm global
### Model
gemini-3.1-pro-preview
### Provider / routing chain
google-gemini-cli
### Config file / key location
_No response_
### Additional provider/model setup details
_No response_
### Logs, screenshots, and evidence
```shell
openclaw models auth login --provider google-gemini-cli --set-default
🦞 OpenClaw 2026.3.12 (6472949) — Finally, a use for that always-on Mac Mini under your desk.
│
│
◇ Gemini CLI OAuth ───────────────────────────────────────────────╮
│ │
│ Browser will open for Google authentication. │
│ Sign in with your Google account for Gemini CLI access. │
│ The callback will be captured automatically on localhost:8085. │
│ │
├──────────────────────────────────────────────────────────────────╯
◇ Gemini CLI OAuth failed
│
◇ OAuth help ────────────────────────────────────────────────────────────╮
│ │
│ Trouble with OAuth? Ensure your Google account has Gemini CLI access. │
│ │
├─────────────────────────────────────────────────────────────────────────╯
HTTPS_PROXY=http://127.0.0.1:7897 \
HTTP_PROXY=http://127.0.0.1:7897 \
curl -I https://accounts.google.com
HTTP/1.1 200 Connection established
HTTP/2 302Impact and severity
Unable to use google-gemini-cli/... models in a proxied macOS environment via OAuth.
Workaround is to use the Google API key provider (google/gemini-3.1-pro-preview) instead of google-gemini-cli, but that bypasses CLI-specific behavior.
Additional information
- OAuth used to work on this machine in earlier OpenClaw / google-gemini-cli versions after applying the
pinDns: false + 60s timeout patch in oauth.ts.
- After upgrading to OpenClaw 2026.3.12 and the latest google-gemini-cli, the same environment and proxy configuration now consistently fails with
TypeError: fetch failed.
- Using the Google API key provider (
google/gemini-3.1-pro-preview) works fine as the default model in the same proxy environment.
- Environment details:
- macOS on Apple Silicon (MacBook Air)
- Proxy client: ClashVerge(system HTTP/HTTPS proxy enabled, 127.0.0.1:7897)
- Node + npm installed via nvm
- There are no additional
HTTP_PROXY/HTTPS_PROXY env vars set when running openclaw models auth login beyond the macOS system proxy.
Bug type
Regression (worked before, now fails)
Summary
On macOS behind an HTTP(S) proxy, google-gemini-cli OAuth consistently fails with:
TypeError: fetch failed
This happens even though:
• The proxy works for all relevant Google endpoints (verified via curl)
• The oauth.ts in @google/gemini-cli has already been patched with DEFAULT_FETCH_TIMEOUT_MS = 60000 and pinDns: false
Using the Google API key provider (google/gemini-3.1-pro-preview) works fine.
Only the google-gemini-cli OAuth flow is broken.
Environment
• Network: macOS system HTTP(S) proxy enabled
• HTTP/HTTPS proxy: http://127.0.0.1:7897
• Also tried with explicit HTTP_PROXY / HTTPS_PROXY in the shell
Steps to reproduce
Impact and severity
Unable to use google-gemini-cli/... models in a proxied macOS environment via OAuth.
Workaround is to use the Google API key provider (google/gemini-3.1-pro-preview) instead of google-gemini-cli, but that bypasses CLI-specific behavior.
Additional information
pinDns: false+ 60s timeout patch in oauth.ts.TypeError: fetch failed.google/gemini-3.1-pro-preview) works fine as the default model in the same proxy environment.HTTP_PROXY/HTTPS_PROXYenv vars set when runningopenclaw models auth loginbeyond the macOS system proxy.